0d6870a3d1b27ae23c9e2c413fb2b367b69323ead81bf38524a54cc17e8a809b | Triage

Analysis

max time kernel
168s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
13-04-2022 00:45

Sharing

Report Analysis Logs

General

Target

node_sqlite3.dll
Size

275KB
MD5

4ef8392550dea714b50f6c820e707c78
SHA1

6aee464956b76809ab24f4841ba64cae7a683f05
SHA256

e866f4418d86319f07a809904d8bce0c095ba858976078fcdaf7a23681b62f11
SHA512

b2edbcb2ccf0dd88277d49a52fb4c7f39f2858a4efe6282b62888d35af88dfc0653f884299b340d121b79c71bc49f091ce059b308f70c575210ed35aedf5de5f

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4864 3044 WerFault.exe rundll32.exe
4564 3044 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4764 wrote to memory of 3044	4764	rundll32.exe	rundll32.exe
PID 4764 wrote to memory of 3044	4764	rundll32.exe	rundll32.exe
PID 4764 wrote to memory of 3044	4764	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\node_sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\node_sqlite3.dll,#1
2⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 560
3⤵
- Program crash
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 848
3⤵
- Program crash
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 3044
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3044 -ip 3044
1⤵
PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-124-0x0000000000000000-mapping.dmp

Download